SigmaHQ Detections
@sigmaHQ12 followers122,433 downloads2,527 copies16 likes159,759 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of 'mpiexec.exe' from the HPC pack with specific command-line flags ('/n 1' or '-n 1'). This combination indicates an attempt to abuse 'mpiexec.exe' as a LOLBIN (Living Off the Land Binary) to proxy the execution of other binaries, potentially bypassing security controls.
Detects password policy discovery commands
Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
This rule detects the creation or modification of email forwarding or redirection rules within Microsoft 365 audit logs. It specifically looks for operations related to 'UpdateInboxRules', 'Set-Mailbox', 'New-InboxRule', and 'Set-InboxRule' that include parameters indicative of forwarding or redirecting emails, such as 'Forward', 'Recipients', 'ForwardingSmtpAddress', 'ForwardingAddress', 'ForwardAsAttachmentTo', 'ForwardTo', 'RedirectTo', and 'RedirectToRecipients'. This activity can be a sign of an attacker attempting to exfiltrate sensitive information from a compromised mailbox or maintain persistence.
Detects when an application (service principal) is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. This activity can indicate privilege escalation or persistence by an attacker who has compromised an application.
Detects potential RDP Session Hijacking activity on Windows systems
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Page 381 of 680